| عنوان | jofpin trape latest (main/master branch) CWE-306 |
|---|
| الوصف | Multiple victim-facing endpoints accept an arbitrary vId/id from the request body and update victim records without verifying that the caller actually owns that vId. The vId is generated client-side (or defaults to a 5-char token) and is never validated against any server-issued credential. This breaks the integrity business rule: each tracked session's data (IP, online status, last ping time, battery, GPU, navigation mode) should reflect the actual victim's state. An attacker can overwrite another victim's recorded data, mark them online/offline, or poison their geolocation. Exploitation: 1. Attacker POSTs to /cIp with id=victim_A_id&ip=192.168.99.99, corrupting victim A's recorded local IP. 2. Attacker POSTs to /tping with id=victim_B_id every few seconds, keeping a victim falsely 'online' forever and hiding their actual disconnect. 3. Attacker POSTs to /lr with vId=victim_C_id&lat=0&lon=0 to spoof geolocation. The vId tokens are only 5 characters from a limited charset, making enumeration feasible. |
|---|
| المصدر | ⚠️ https://github.com/jofpin/trape/issues/407 |
|---|
| المستخدم | GalaxynC (UID 98975) |
|---|
| ارسال | 18/07/2026 09:35 PM (2 أشهر منذ) |
|---|
| الاعتدال | 06/09/2026 08:25 PM (2 months later) |
|---|
| الحالة | مكرر |
|---|
| إدخال VulDB | 398786 [jofpin trape 2.0 core/user.py vId/id تجاوز الصلاحيات] |
|---|
| النقاط | 0 |
|---|